<?php
declare(strict_types=1); require_once __DIR__ . '/config.php'; require_once __DIR__ . '/encrypt.php'; $c = $_GET['c'] ?? ''; if ($c === '') { http_response_code(400); exit; } $path = Crypt::d($c); if ($path === $c || empty($path)) { http_response_code(403); exit; } $baseDir = dirname(__DIR__); $fullPath = realpath($baseDir . '/' . $path); if ($fullPath === false || strpos($fullPath, $baseDir) !== 0 || !file_exists($fullPath)) { http_response_code(404); exit; } $mime = mime_content_type($fullPath); if (!in_array($mime, ['image/jpeg', 'image/png', 'image/gif', 'image/webp'])) { http_response_code(415); exit; } header('Content-Type: ' . $mime); header('Cache-Control: public, max-age=86400'); $img = null; switch ($mime) { case 'image/jpeg': $img = @imagecreatefromjpeg($fullPath); break; case 'image/png': $img = @imagecreatefrompng($fullPath); break; case 'image/gif': $img = @imagecreatefromgif($fullPath); break; case 'image/webp': $img = @imagecreatefromwebp($fullPath); break; } if (!$img) { readfile($fullPath); exit; } if ($mime === 'image/png' || $mime === 'image/webp') { imagepalettetotruecolor($img); imagealphablending($img, true); imagesavealpha($img, true); } switch ($mime) { case 'image/jpeg': imagejpeg($img, null, 90); break; case 'image/png': imagepng($img); break; case 'image/gif': imagegif($img); break; case 'image/webp': imagewebp($img, null, 90); break; } imagedestroy($img); exit;
if (!defined('STORE_ROOT')) { http_response_code(403); exit; }
